Intel PROSet/Wireless WiFi CVE-2026-20789

Local code execution on a Windows system running Intel PROSet/Wireless WiFi Software is required - the attack vector is explicitly local (AV:L). Crucially, no privileges are required (PR:N per CVSS 4.0), meaning any process - including those running under standard user accounts or within low-integrity contexts - can attempt exploitation without needing administrative rights or authenticated sessions. No user interaction is required (UI:N) and no special attack requirements apply (AT:N), confirming this is exploitable against default driver installations without knowledge of internal system state. Limiting factors: physical or logical local access to the target machine is mandatory; remote exploitation over network is not possible per the AV:L vector. The vulnerability is Windows-only and requires Intel PROSet/Wireless WiFi Software to be installed and the associated driver to be loaded. Systems using OS-native or third-party WiFi drivers are not affected.

The CVSS 4.0 score of 8.4 is justified by a compelling combination of signals: local vector (AV:L), no attack requirements (AT:N), no privileges required (PR:N), no user interaction (UI:N), and high subsequent-system confidentiality impact (SC:H). The PR:N rating for a local exploit is notable - it means any running process, including low-integrity sandboxed code, is a potential attacker. No EPSS data was provided, which limits probabilistic assessment; however, the attack profile (local, unprivileged, zero-interaction, low complexity) is highly attractive for use as a second-stage escalation following initial access. No CISA KEV listing and no POC are confirmed at time of analysis, suggesting the vulnerability is not yet being actively abused at scale. Despite the absence of known exploitation, the product footprint across enterprise laptops with Intel wireless hardware means the attack surface is broad. The subsequent-system high-confidentiality impact (SC:H) combined with low integrity and availability impacts on the subsequent system may indicate kernel memory read primitives rather than full kernel code execution - this distinction matters for impact scoping but should be confirmed against the vendor advisory.

An attacker who has achieved initial code execution on a Windows endpoint - for example, via a phishing-delivered macro or a browser sandbox escape - runs an unprivileged process that directly interacts with the Intel PROSet/Wireless driver interface. By exploiting the missing access control boundary (CWE-284) at Ring 2, the process triggers driver functionality reserved for higher-privilege callers, achieving local privilege escalation and potential read access to kernel memory. No public proof-of-concept is confirmed at time of analysis, but the zero-complexity, zero-privilege requirement lowers the bar for exploit development significantly.